The Association of Clinical Research Organizations (ACRO) has commended the long-awaited privacy rule issued by the Department of Health and Human Services (HHS), saying the proposal strikes an “appropriate balance” between protecting patients and allowing researchers access to health information critical for drug safety monitoring and comparative effectiveness studies.

ACRO raised concerns with various governmental agencies about a provision in last year’s Health Information Technology for Economic and Clinical Health (HITECH) legislation, which greatly expanded the privacy provisions of the Health Insurance Portability and Accountability Act (HIPAA). The provisions had the potential for making post-approval research on drugs more difficult by discouraging the creation and use of health care databases.

The proposed regulations, which will not be effective until publication of a final rule, address ACRO’s concerns by allowing researchers to use what HIPAA calls “limited data sets,” which are health records that hide the identity of patients but may include personal information such as birth dates or zip codes, without requiring authorization from each subject.

“HHS has recognized the integral role such data plays in areas like drug safety monitoring, comparative effectiveness research, public health surveillance and health care operations,” said Doug Peddicord, Ph.D., ACRO’s executive director. “This notice of proposed rulemaking suggests that the department has heard our concerns and made specific provision in the new privacy rules that should, if nothing else, facilitate continued creation and use of large data-bases. From our perspective, it was good news in terms of research.”

In addition, the proposed rule would simplify clinical research by allowing a “
compound authorization,” which means that a researcher could obtain a single consent for a project that includes both a clinical trial component and storage of study specimens for use at a later date. Current regulations require researchers to obtain two separate consents for these types of studies.

The HHS, which published its proposed rule in the Federal Register on July 14, has asked for additional feedback on how the HIPAA privacy rule can be modified to make research easier for individuals and companies while still protecting individual privacy. ACRO will encourage HHS to consider a change that would allow researchers to ask individuals for permission to store their genetic information and use it at a future date for an “unspecified” research project.

“The current privacy rule says that I can’t ask for your permission for such research because it’s in the future and unspecified,” Peddicord said. “What the HHS has said is, ‘Talk to us about this. Tell us about how we can facilitate research-use of stored health data for the good of individuals and of society.’”

To bring attention to this research issue, ACRO worked with the Healthcare Leadership Council, which has a broad membership that includes executives from major pharmaceutical companies, academic health centers and health insurance companies. “The privacy rule and its impact, both on interventional and information-based research, is a broad concern,” said Peddicord. “It has an impact not only on researchers, but also on academic institutions and payers, who are going to want to do comparative effectiveness research in the future. The extent to which there are rules that make that harder, they all have an interest.”

—Karyn Korieth